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There are many ways to covertly monitor conversations. А 
microphone or miniature radio transmitter could be planted in the target 
area. High gain amplifiers with special microphones are used to listen 
through walls and windows. Parabolic mics and laser monitoring systems 
are used to listen in from far away. The telephone can be tapped or bugged 
іп a variety of ways. Many times, however, electronic surveillance involves 
costly equipment that may not be recovered. | 

There із а cheap and effective way to bug а room. With a piece of 
wire, an audio amplifier from Radio Shack, and a few cents worth of 
electronic parts you can modify a telephone to monitor room conversations. 
This modification, called the “hot-mic" or hookswitch bypass, uses the 
phone's own microphone and sends the room's audio down the phone line 
without affecting phone operation. This report will show several ways to 
perform a hot-mic modification and also how to detect one. 

Note: This report is based on the Western Electric 500 type Touch 
Tonee telephone. The modifications will work on other telephones but 


details such as wire color and location will be different. 
Theory of Operation 


To understand how the hot-mic works, we need to know a little about 
how the telephone works. The telephone is powered by 48 to 52 volts DC. 
When the phone is in use or off hook this voltage drops to about 6 volts. In 
the four-wire phone cable used at most residences, this voltage and phone 


audio is carried in the red and green wires, called the ring and tip, 


respectively. The ring is negative and the tip is positive. The phone itself 
roughly consists of the ringer, sidetone coils, hookswitch, earphone and 
microphone. The microphone is a carbon or electret type that requires some 
voltage to operate. When the phone is off the hook, 6 volts is supplied to the 
microphone. 

Here's how the hot-mic works: if a resistor, or а resistor in 
combination with another component is placed scrass the hookswitch, 
enough current will pass to power the phone's microphone but not trip the 
relay at the central office. Then the microphone transmits room sounds 
down the phone lines while it is on the hook. The audio is recovered with an 
audio amplifier anywhere along the phone line. When someone uses the 
modified phone, the hookswitch closes and shorts out the resistor. The 
phone then operates normally. Fig. 2 shows the schematic. The resistor 
alone is only one hot-mic technique. A more effective job can be done with a 
resistor and capacitor in parallel or a resistor in series With a semiconductor 
device called a diac. Also, a 9 volt battery can be used to hot-mic some 


phones. 


HOT-MIC WITH A RESISTOR 


Using a resistor is the easiest way to hot-mic a phone. With this 
method, a resistor is placed across the hookswitch, thus activating the 
phone's mic. Since most phones contain two (ог more) hookswitches, the 
second hookswitch is shorted out. The value of the resistor must not be too 
high or too low. If it is too low, too much current will flow and the phone 
will appear to be off hook, causing a dial tone. If it is too high, the audio will 


be too weak to recover with the amplifier. A resistance of 10k across the 


hookswitch will not cause any of the above problems. А resistance as low аз 
2.2k can be used, but problems such as an altered ring or room sounds on 
extension phones may result. After you install the resistor and jumper, 
check to make sure that all phones ring nor malty and that room audio isn't 
audible on any extensions. It is advantageous to use as low a resistance as 
possible because the room audio will come through stronger. 

The room audio can be recovered anywhere along the phone line with 
an audio amplifier. Radio Shack sells a nice mini amplifier for $11.95. 
Connect the amp to the phone line via a .022 uf capacitor to block out the DC 
voltage as in fig. 1. You should hear room sounds although they may be 
weak. This same setup can be used to eavesdrop on phone conversations 
too. A word of warning: if you are listening to room audio with the amp 
cranked up all the way and the someone picks up the phone, the phone 
conversation is going the be very loud! 

The same amplifier setup is used with other hot-mic techniques too, 


such as the... 


HOT-MIC WITH A RESISTOR AND CAPACITOR 


This setup works the same way as the previous one, except a capacitor 
is placed in parallel with the resistor. See fig. 3 for the schematic. The 
resistor allows some DC current to pass in order to power the mic. The audio 
voltage from the mic, instead of being attenuated by the resistor, passes 
easily through the capacitor. This method is better than using just a resistor 
because the room audio comes through stronger. Good results can be 


obtained using a .47uf or ІШ capacitor and a 10k resistor. The capacitor 





must have а rating of at least 200 volts. Аз before, check іо таке sure that 


the ring is not affected and that room audio can't be heard on extensions. 


HOT-MIC WITH A RESISTOR AND A DIAC 


This method is similar to the others also. A resistor and a diac are 
placed in series across the hookswitch as in fig. 4. A diac is a bidirectional 
triggering device similar to a diode which conducts only after a certain 
breakover voltage is reached. In the hot-mic, the diac conducts when the 
phone is on hook, but does not conduct when the phone (or any extension) is 
off hook. This is because the voltage on the phone line drops below the 
diac's breakover voltage when a phone is off hook. The advantage if this 
circuit is that no room audio is heard on the extensions because the diac 
turns the hot-mic off when an extension is picked up. Since we don't have to 
worry about interference on extensions, we can let more mic audio leak into 
the phone lines and get a stronger signal at the amp. Use a 2.2k resistor and 
a diac such as Mouser Electronics 519-HT-40. Other diacs will also work. If 
the phone doesn't ring properly try a higher resistance up to a 4.7K. 

This circuit is the best choice for a hot-mic. It offers the most 


sensitive audio and automatically turns off when any the phone is in use. 


HOT-MIC WITH A 9 VOLT BATTERY 


this circuit uses a different technique to power the microphone. 
Instead of leeching the power from the phone line, a 9V battery is used. 
This circuit offers sensitive audio and does not produce a voltage drop on the 


line. However, it is only useful if there are no extension phones on the line 


because audio will be present on extensions. The 9У battery із connected to 
the mic via a 1k resistor to limit current and prolong battery life. One 
hookswitch is shorted out, and a .47 uf capacitor is placed across the other. 
In order to turn off the battery when the modified phone is in use, the 
circuit uses the phone's unused hookswitch contacts. See fig. 5 for schematic. 
Fig. 6 shows a binding post diagram for the Western Electric phone. Оп a 
Western Electric 500 type phone the complete hot-mic would consist of the 
following connections: 

1. Connect a jumper from L2 to С 

2. Connect +9V to a 1k resistor then to F 

3. Disconnect the grey wire from L2 and connect it to -9V 

4. Disconnect the yellow wire from L2 and connect it to B 

5. Connect a .47 uf cap from L1 to F 

This hot-mic can be done with other phones but the hookswitch must 


contain a switch that is с/оѕед when on hook and open when off hook. 


HOW TO DETECT A HOT-MIC 


Although a correctly installed hot-mic should not be detectable during 
normal phone use, there are a few easy ways to check phones for this 
modification. 

1. Check the microphone contacts or wires leading to the mic with a 
voltmeter. There should be no voltage here when the phone is on hook. If 
there is, something is definitely wrong. 

2. Connect an amplifier across the phone line and listen for any 
suspicious audio. Also check all different combinations of red, green, yellow, 


and black wires for audio. There should be none. 





3. Check the оп hook voltage across the phone lines. If it is less than 
48 volts, a hot-mic circuit may be the cause of the voltage drop. A series 
phone bug will also cause a drop, but in any case it means trouble. 

4. Physically inspect the phone. Look for any suspicious wires, 
resistors, or other components. 

5. Listen closely to the earphone while the phone is ringing. If there 
is a faint clicking noise, it means that ringing voltage is leaking into phone 


circuitry where it shouldn't be. А hot-mic could be the cause. 


CONCLUSION 


This report has shown several ways to make a hot-mic type phone 
modification. Also several ways of detecting a hot-mic were explained. One 
should be aware of this method of electronic surveillance. Because of its low 
cost and simplicity, the hot-mic poses a considerable threat to privacy. 
Knowledge of it should be available to electronic counter measures 


professionals as well as average citizens. 
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Oh yes, here we have yet another AM transmitter bug! Also easy to build from a handful of parts. Also easy to 
hide in practical places such as behind phone jacks situated near target areas, under desks, etc. 
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This is ап easy-to-build room or office bug. It uses very few parts and will transmit to a commercial A.M. 
station. It is very small and compact, thus making it easy to conceal. Suggested hiding places are behind 
pictures, velcroed to desk, etc. А bug exactly like this was built into a small homemade ceramic ashtray. 
A wire spring such as those found on spiral notebooks was fastened onto the top of the ashtray for users 


to place their cigarettes into to hold them while not smoking. Little did they know that this innocent 
lokking ashtray was also a BUG! The coil spring served as the antenna for the bug and did its job well!! 
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SNEAKY SPIRO'S А.М. BAND TRANSMITTER BUG FOR OUTPUT ТО A.M. RADIO STATIONS. Easy-to-build and use!! 
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This bug was designed Бу Grant Collier and has been used extensively by him. Output 
is to a commercial AM channel. This is a VERY compact and easu to hide bug and is 
also very easy-to-build. 
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This is Nicholas Black's Am transmitter BUG. It is а very effective bug when used properly. Output is to 
commercial Am channels. 
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TRICKY DICK'S OFFICE BUG---A.M. TRANSMITTER FOR OUTPUT ТО AM RADIO BANDS. EFFECTIVE BUG FOR TAPING CONVERSATIONS. 
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